Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
05/02/2026, 16:19
General
- Target 53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe
- Size 5.4MB
- Sample260205-tspbpsdw2g
- SHA256 53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728
Malware Config
Extracted
-
quasar
-
1.4.1
-
SPAIN2
-
twart.myfirewall.org:9792
-
rency.ydns.eu:5287
-
wqo9.firewall-gateway.de:8841
-
code1.ydns.eu:5287
-
wqo9.firewall-gateway.de:9792
-
Q4e9mb0d-11cb-44R6b-T1b-05f80M1dcIfx051
-
encryption_key
3145298725BA5E0DD56E87FFE3F8898EA81E6EDA
-
install_name
Notepadbook.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
6000
-
startup_key
Adobe PDF
-
subdirectory
WindowsMD
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe"C:\Users\Admin\AppData\Local\Temp\53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe"C:\Users\Admin\AppData\Local\Temp\53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Adobe PDF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Adobe PDF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe" /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exeC:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe.log
Notepadbook.exe
memory/1180-1495-0x0000000006910000-0x0000000006F28000-memory.dmp
memory/1180-1496-0x0000000006480000-0x00000000064D0000-memory.dmp
memory/1180-1500-0x0000000007A20000-0x0000000007A86000-memory.dmp
memory/1180-1498-0x00000000066C0000-0x00000000066D2000-memory.dmp
memory/1180-1499-0x0000000007970000-0x00000000079AC000-memory.dmp
memory/1180-1497-0x00000000066F0000-0x00000000067A2000-memory.dmp
memory/1748-512-0x0000000005550000-0x0000000005560000-memory.dmp
memory/5324-83-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-497-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5324-39-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-57-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-123-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-131-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-129-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-128-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-126-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-494-0x0000000005D70000-0x0000000005D71000-memory.dmp
memory/5324-495-0x0000000005F20000-0x0000000005F2A000-memory.dmp
memory/5324-122-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-119-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-115-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-114-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-111-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-69-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-105-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-101-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-97-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-496-0x0000000006360000-0x0000000006376000-memory.dmp
memory/5324-95-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-93-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-87-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-65-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-81-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-79-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-75-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-73-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-117-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-107-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-103-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-99-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-91-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-89-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-4-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5324-77-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-71-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-109-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-5-0x0000000005FE0000-0x0000000006030000-memory.dmp
memory/5324-85-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-67-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-63-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-61-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-59-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-55-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-53-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-49-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-47-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-45-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-43-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-41-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-37-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-35-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-33-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-32-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-29-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-25-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-23-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-19-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-17-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-51-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-27-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-21-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-15-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-13-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-11-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-9-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-498-0x0000000003610000-0x0000000003626000-memory.dmp
memory/5324-499-0x0000000003630000-0x0000000003636000-memory.dmp
memory/5324-7-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-3-0x0000000005F40000-0x0000000005FDC000-memory.dmp
memory/5324-2-0x0000000005D90000-0x0000000005E22000-memory.dmp
memory/5324-1-0x0000000006450000-0x00000000069F4000-memory.dmp
memory/5324-0-0x0000000000E40000-0x00000000013A2000-memory.dmp
memory/5324-6-0x0000000005FE0000-0x0000000006049000-memory.dmp
memory/5324-500-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5324-501-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5780-504-0x0000000000400000-0x0000000000724000-memory.dmp
memory/5780-505-0x0000000005AB0000-0x0000000005AC0000-memory.dmp